1 /* $NetBSD: map_object.c,v 1.61 2020/03/04 01:21:17 thorpej Exp $ */ 2 3 /* 4 * Copyright 1996 John D. Polstra. 5 * Copyright 1996 Matt Thomas <matt@3am-software.com> 6 * Copyright 2002 Charles M. Hannum <root@ihack.net> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by John Polstra. 20 * 4. The name of the author may not be used to endorse or promote products 21 * derived from this software without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 24 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 25 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 26 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 27 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 28 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 32 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include <sys/cdefs.h> 36 #ifndef lint 37 __RCSID("$NetBSD: map_object.c,v 1.61 2020/03/04 01:21:17 thorpej Exp $"); 38 #endif /* not lint */ 39 40 #include <errno.h> 41 #include <stddef.h> 42 #include <stdlib.h> 43 #include <string.h> 44 #include <unistd.h> 45 #include <sys/stat.h> 46 #include <sys/types.h> 47 #include <sys/mman.h> 48 49 #include "debug.h" 50 #include "rtld.h" 51 52 static int protflags(int); /* Elf flags -> mmap protection */ 53 54 #define EA_UNDEF (~(Elf_Addr)0) 55 56 /* 57 * Map a shared object into memory. The argument is a file descriptor, 58 * which must be open on the object and positioned at its beginning. 59 * 60 * The return value is a pointer to a newly-allocated Obj_Entry structure 61 * for the shared object. Returns NULL on failure. 62 */ 63 Obj_Entry * 64 _rtld_map_object(const char *path, int fd, const struct stat *sb) 65 { 66 Obj_Entry *obj; 67 Elf_Ehdr *ehdr; 68 Elf_Phdr *phdr; 69 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 70 Elf_Phdr *phtls; 71 #endif 72 size_t phsize; 73 Elf_Phdr *phlimit; 74 Elf_Phdr *segs[2]; 75 int nsegs; 76 caddr_t mapbase = MAP_FAILED; 77 size_t mapsize = 0; 78 int mapflags; 79 Elf_Off base_offset; 80 Elf_Addr base_alignment; 81 Elf_Addr base_vaddr; 82 Elf_Addr base_vlimit; 83 Elf_Addr text_vlimit; 84 int text_flags; 85 void *base_addr; 86 Elf_Off data_offset; 87 Elf_Addr data_vaddr; 88 Elf_Addr data_vlimit; 89 int data_flags; 90 caddr_t data_addr; 91 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 92 Elf_Addr tls_vaddr = 0; /* Noise GCC */ 93 #endif 94 Elf_Addr phdr_vaddr; 95 size_t phdr_memsz; 96 caddr_t gap_addr; 97 size_t gap_size; 98 int i; 99 #ifdef RTLD_LOADER 100 Elf_Addr clear_vaddr; 101 caddr_t clear_addr; 102 size_t nclear; 103 #endif 104 #ifdef GNU_RELRO 105 Elf_Addr relro_page; 106 size_t relro_size; 107 #endif 108 109 if (sb != NULL && sb->st_size < (off_t)sizeof (Elf_Ehdr)) { 110 _rtld_error("%s: not ELF file (too short)", path); 111 return NULL; 112 } 113 114 obj = _rtld_obj_new(); 115 obj->path = xstrdup(path); 116 obj->pathlen = strlen(path); 117 if (sb != NULL) { 118 obj->dev = sb->st_dev; 119 obj->ino = sb->st_ino; 120 } 121 122 ehdr = mmap(NULL, _rtld_pagesz, PROT_READ, MAP_FILE | MAP_SHARED, fd, 123 (off_t)0); 124 obj->ehdr = ehdr; 125 if (ehdr == MAP_FAILED) { 126 _rtld_error("%s: read error: %s", path, xstrerror(errno)); 127 goto bad; 128 } 129 /* Make sure the file is valid */ 130 if (memcmp(ELFMAG, ehdr->e_ident, SELFMAG) != 0) { 131 _rtld_error("%s: not ELF file (magic number bad)", path); 132 goto bad; 133 } 134 if (ehdr->e_ident[EI_CLASS] != ELFCLASS) { 135 _rtld_error("%s: invalid ELF class %x; expected %x", path, 136 ehdr->e_ident[EI_CLASS], ELFCLASS); 137 goto bad; 138 } 139 /* Elf_e_ident includes class */ 140 if (ehdr->e_ident[EI_VERSION] != EV_CURRENT || 141 ehdr->e_version != EV_CURRENT || 142 ehdr->e_ident[EI_DATA] != ELFDEFNNAME(MACHDEP_ENDIANNESS)) { 143 _rtld_error("%s: unsupported file version", path); 144 goto bad; 145 } 146 if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) { 147 _rtld_error("%s: unsupported file type", path); 148 goto bad; 149 } 150 switch (ehdr->e_machine) { 151 ELFDEFNNAME(MACHDEP_ID_CASES) 152 default: 153 _rtld_error("%s: unsupported machine", path); 154 goto bad; 155 } 156 157 /* 158 * We rely on the program header being in the first page. This is 159 * not strictly required by the ABI specification, but it seems to 160 * always true in practice. And, it simplifies things considerably. 161 */ 162 assert(ehdr->e_phentsize == sizeof(Elf_Phdr)); 163 assert(ehdr->e_phoff + ehdr->e_phnum * sizeof(Elf_Phdr) <= 164 _rtld_pagesz); 165 166 /* 167 * Scan the program header entries, and save key information. 168 * 169 * We rely on there being exactly two load segments, text and data, 170 * in that order. 171 */ 172 phdr = (Elf_Phdr *) ((caddr_t)ehdr + ehdr->e_phoff); 173 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 174 phtls = NULL; 175 #endif 176 phsize = ehdr->e_phnum * sizeof(phdr[0]); 177 obj->phdr = NULL; 178 #ifdef GNU_RELRO 179 relro_page = 0; 180 relro_size = 0; 181 #endif 182 phdr_vaddr = EA_UNDEF; 183 phdr_memsz = 0; 184 phlimit = phdr + ehdr->e_phnum; 185 nsegs = 0; 186 while (phdr < phlimit) { 187 switch (phdr->p_type) { 188 case PT_INTERP: 189 obj->interp = (void *)(uintptr_t)phdr->p_vaddr; 190 dbg(("%s: PT_INTERP %p", obj->path, obj->interp)); 191 break; 192 193 case PT_LOAD: 194 if (nsegs < 2) 195 segs[nsegs] = phdr; 196 ++nsegs; 197 198 dbg(("%s: %s %p phsize %" PRImemsz, obj->path, "PT_LOAD", 199 (void *)(uintptr_t)phdr->p_vaddr, phdr->p_memsz)); 200 break; 201 202 case PT_PHDR: 203 phdr_vaddr = phdr->p_vaddr; 204 phdr_memsz = phdr->p_memsz; 205 dbg(("%s: %s %p phsize %" PRImemsz, obj->path, "PT_PHDR", 206 (void *)(uintptr_t)phdr->p_vaddr, phdr->p_memsz)); 207 break; 208 209 #ifdef GNU_RELRO 210 case PT_GNU_RELRO: 211 relro_page = phdr->p_vaddr; 212 relro_size = phdr->p_memsz; 213 break; 214 #endif 215 216 case PT_DYNAMIC: 217 obj->dynamic = (void *)(uintptr_t)phdr->p_vaddr; 218 dbg(("%s: %s %p phsize %" PRImemsz, obj->path, "PT_DYNAMIC", 219 (void *)(uintptr_t)phdr->p_vaddr, phdr->p_memsz)); 220 break; 221 222 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 223 case PT_TLS: 224 phtls = phdr; 225 dbg(("%s: %s %p phsize %" PRImemsz, obj->path, "PT_TLS", 226 (void *)(uintptr_t)phdr->p_vaddr, phdr->p_memsz)); 227 break; 228 #endif 229 #ifdef __ARM_EABI__ 230 case PT_ARM_EXIDX: 231 obj->exidx_start = (void *)(uintptr_t)phdr->p_vaddr; 232 obj->exidx_sz = phdr->p_memsz; 233 break; 234 #endif 235 } 236 237 ++phdr; 238 } 239 phdr = (Elf_Phdr *) ((caddr_t)ehdr + ehdr->e_phoff); 240 obj->entry = (void *)(uintptr_t)ehdr->e_entry; 241 if (!obj->dynamic) { 242 _rtld_error("%s: not dynamically linked", path); 243 goto bad; 244 } 245 if (nsegs != 2) { 246 _rtld_error("%s: wrong number of segments (%d != 2)", path, 247 nsegs); 248 goto bad; 249 } 250 251 /* 252 * Map the entire address space of the object as a file 253 * region to stake out our contiguous region and establish a 254 * base for relocation. We use a file mapping so that 255 * the kernel will give us whatever alignment is appropriate 256 * for the platform we're running on. 257 * 258 * We map it using the text protection, map the data segment 259 * into the right place, then map an anon segment for the bss 260 * and unmap the gaps left by padding to alignment. 261 */ 262 263 base_alignment = segs[0]->p_align; 264 base_offset = round_down(segs[0]->p_offset); 265 base_vaddr = round_down(segs[0]->p_vaddr); 266 base_vlimit = round_up(segs[1]->p_vaddr + segs[1]->p_memsz); 267 text_vlimit = round_up(segs[0]->p_vaddr + segs[0]->p_memsz); 268 text_flags = protflags(segs[0]->p_flags); 269 data_offset = round_down(segs[1]->p_offset); 270 data_vaddr = round_down(segs[1]->p_vaddr); 271 data_vlimit = round_up(segs[1]->p_vaddr + segs[1]->p_filesz); 272 data_flags = protflags(segs[1]->p_flags); 273 #ifdef RTLD_LOADER 274 clear_vaddr = segs[1]->p_vaddr + segs[1]->p_filesz; 275 #endif 276 277 obj->textsize = text_vlimit - base_vaddr; 278 obj->vaddrbase = base_vaddr; 279 obj->isdynamic = ehdr->e_type == ET_DYN; 280 281 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 282 if (phtls != NULL) { 283 ++_rtld_tls_dtv_generation; 284 obj->tlsindex = ++_rtld_tls_max_index; 285 obj->tlssize = phtls->p_memsz; 286 obj->tlsalign = phtls->p_align; 287 obj->tlsinitsize = phtls->p_filesz; 288 tls_vaddr = phtls->p_vaddr; 289 } 290 #endif 291 292 obj->phdr_loaded = false; 293 for (i = 0; i < nsegs; i++) { 294 if (phdr_vaddr != EA_UNDEF && 295 segs[i]->p_vaddr <= phdr_vaddr && 296 segs[i]->p_memsz >= phdr_memsz) { 297 obj->phdr_loaded = true; 298 break; 299 } 300 if (segs[i]->p_offset <= ehdr->e_phoff && 301 segs[i]->p_memsz >= phsize) { 302 phdr_vaddr = segs[i]->p_vaddr + ehdr->e_phoff; 303 phdr_memsz = phsize; 304 obj->phdr_loaded = true; 305 break; 306 } 307 } 308 if (obj->phdr_loaded) { 309 obj->phdr = (void *)(uintptr_t)phdr_vaddr; 310 obj->phsize = phdr_memsz; 311 } else { 312 Elf_Phdr *buf; 313 buf = xmalloc(phsize); 314 if (buf == NULL) { 315 _rtld_error("%s: cannot allocate program header", path); 316 goto bad; 317 } 318 memcpy(buf, phdr, phsize); 319 obj->phdr = buf; 320 obj->phsize = phsize; 321 } 322 dbg(("%s: phdr %p phsize %zu (%s)", obj->path, obj->phdr, obj->phsize, 323 obj->phdr_loaded ? "loaded" : "allocated")); 324 325 /* Unmap header if it overlaps the first load section. */ 326 if (base_offset < _rtld_pagesz) { 327 munmap(ehdr, _rtld_pagesz); 328 obj->ehdr = MAP_FAILED; 329 } 330 331 /* 332 * Calculate log2 of the base section alignment. 333 */ 334 mapflags = 0; 335 if (base_alignment > _rtld_pagesz) { 336 unsigned int log2 = 0; 337 for (; base_alignment > 1; base_alignment >>= 1) 338 log2++; 339 mapflags = MAP_ALIGNED(log2); 340 } 341 342 base_addr = NULL; 343 #ifdef RTLD_LOADER 344 if (!obj->isdynamic) { 345 mapflags |= MAP_TRYFIXED; 346 base_addr = (void *)(uintptr_t)base_vaddr; 347 } 348 #endif 349 mapsize = base_vlimit - base_vaddr; 350 mapbase = mmap(base_addr, mapsize, text_flags, 351 mapflags | MAP_FILE | MAP_PRIVATE, fd, base_offset); 352 if (mapbase == MAP_FAILED) { 353 _rtld_error("mmap of entire address space failed: %s", 354 xstrerror(errno)); 355 goto bad; 356 } 357 #ifdef RTLD_LOADER 358 if (!obj->isdynamic && mapbase != base_addr) { 359 _rtld_error("mmap of executable at correct address failed"); 360 goto bad; 361 } 362 #endif 363 364 /* Overlay the data segment onto the proper region. */ 365 data_addr = mapbase + (data_vaddr - base_vaddr); 366 if (mmap(data_addr, data_vlimit - data_vaddr, data_flags, 367 MAP_FILE | MAP_PRIVATE | MAP_FIXED, fd, data_offset) == 368 MAP_FAILED) { 369 _rtld_error("mmap of data failed: %s", xstrerror(errno)); 370 goto bad; 371 } 372 373 /* Overlay the bss segment onto the proper region. */ 374 if (mmap(mapbase + data_vlimit - base_vaddr, base_vlimit - data_vlimit, 375 data_flags, MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0) == 376 MAP_FAILED) { 377 _rtld_error("mmap of bss failed: %s", xstrerror(errno)); 378 goto bad; 379 } 380 381 /* Unmap the gap between the text and data. */ 382 gap_addr = mapbase + round_up(text_vlimit - base_vaddr); 383 gap_size = data_addr - gap_addr; 384 if (gap_size != 0 && mprotect(gap_addr, gap_size, PROT_NONE) == -1) { 385 _rtld_error("mprotect of text -> data gap failed: %s", 386 xstrerror(errno)); 387 goto bad; 388 } 389 390 #ifdef RTLD_LOADER 391 /* Clear any BSS in the last page of the data segment. */ 392 clear_addr = mapbase + (clear_vaddr - base_vaddr); 393 if ((nclear = data_vlimit - clear_vaddr) > 0) 394 memset(clear_addr, 0, nclear); 395 396 /* Non-file portion of BSS mapped above. */ 397 #endif 398 399 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 400 if (phtls != NULL) 401 obj->tlsinit = mapbase + tls_vaddr; 402 #endif 403 404 obj->mapbase = mapbase; 405 obj->mapsize = mapsize; 406 obj->relocbase = mapbase - base_vaddr; 407 408 #ifdef GNU_RELRO 409 /* rounding happens later. */ 410 obj->relro_page = obj->relocbase + relro_page; 411 obj->relro_size = relro_size; 412 #endif 413 414 if (obj->dynamic) 415 obj->dynamic = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->dynamic); 416 if (obj->entry) 417 obj->entry = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->entry); 418 if (obj->interp) 419 obj->interp = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->interp); 420 if (obj->phdr_loaded) 421 obj->phdr = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->phdr); 422 #ifdef __ARM_EABI__ 423 if (obj->exidx_start) 424 obj->exidx_start = (void *)(obj->relocbase + (Elf_Addr)(uintptr_t)obj->exidx_start); 425 #endif 426 427 return obj; 428 429 bad: 430 if (obj->ehdr != MAP_FAILED) 431 munmap(obj->ehdr, _rtld_pagesz); 432 if (mapbase != MAP_FAILED) 433 munmap(mapbase, mapsize); 434 _rtld_obj_free(obj); 435 return NULL; 436 } 437 438 void 439 _rtld_obj_free(Obj_Entry *obj) 440 { 441 Objlist_Entry *elm; 442 Name_Entry *entry; 443 444 #if defined(__HAVE_TLS_VARIANT_I) || defined(__HAVE_TLS_VARIANT_II) 445 if (obj->tls_done) 446 _rtld_tls_offset_free(obj); 447 #endif 448 xfree(obj->path); 449 while (obj->needed != NULL) { 450 Needed_Entry *needed = obj->needed; 451 obj->needed = needed->next; 452 xfree(needed); 453 } 454 while ((entry = SIMPLEQ_FIRST(&obj->names)) != NULL) { 455 SIMPLEQ_REMOVE_HEAD(&obj->names, link); 456 xfree(entry); 457 } 458 while ((elm = SIMPLEQ_FIRST(&obj->dldags)) != NULL) { 459 SIMPLEQ_REMOVE_HEAD(&obj->dldags, link); 460 xfree(elm); 461 } 462 while ((elm = SIMPLEQ_FIRST(&obj->dagmembers)) != NULL) { 463 SIMPLEQ_REMOVE_HEAD(&obj->dagmembers, link); 464 xfree(elm); 465 } 466 if (!obj->phdr_loaded) 467 xfree((void *)(uintptr_t)obj->phdr); 468 xfree(obj); 469 } 470 471 Obj_Entry * 472 _rtld_obj_new(void) 473 { 474 Obj_Entry *obj; 475 476 obj = CNEW(Obj_Entry); 477 SIMPLEQ_INIT(&obj->names); 478 SIMPLEQ_INIT(&obj->dldags); 479 SIMPLEQ_INIT(&obj->dagmembers); 480 return obj; 481 } 482 483 /* 484 * Given a set of ELF protection flags, return the corresponding protection 485 * flags for MMAP. 486 */ 487 static int 488 protflags(int elfflags) 489 { 490 int prot = 0; 491 492 if (elfflags & PF_R) 493 prot |= PROT_READ; 494 #ifdef RTLD_LOADER 495 if (elfflags & PF_W) 496 prot |= PROT_WRITE; 497 #endif 498 if (elfflags & PF_X) 499 prot |= PROT_EXEC; 500 return prot; 501 } 502